Special characters (tab, newline) in license URL

[scom-technology-operations]

What happened:

• We have created a CycloneDX-JSON of our Nexus installation with the last Syft version.
• The UserAgentUtils library version 1.21 is found there as a dependency.
• We have imported this CycloneDX-JSON into the latest version of Dependency-Track.
• There we get the error message:

'$.components[9].licenses[0].license.url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference'

What you expected to happen:

The license URL should be without special characters like newlines and tabs in the JSON field url.

Steps to reproduce the issue:

1. Download .jar file
   https://repo1.maven.org/maven2/eu/bitwalker/UserAgentUtils/1.21/UserAgentUtils-1.21.jar
2. syft --output cyclonedx-json=file.json --verbose

Anything else we need to know?:

• In the file /META-INF/maven/eu.bitwalker/UserAgentUtils/pom.xml the license field is defined as follows.

	<licenses>
		<license>
			<name>New BSD License</name>
			<url>
				http://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt
			</url>
			<distribution>repo</distribution>
		</license>
	</licenses>

• In the CycloneDX-JSON from Syft the license entry is displayed as follows.

      "licenses": [
        {
          "license": {
            "name": "New BSD License",
            "url": "\n\t\t\t\thttp://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt\n\t\t\t"
          }
        }
      ],

Environment:

• Output of syft version:

Application: syft
Version: 1.11.0
BuildDate: 2024-08-09T17:52:25Z
GitCommit: 19cc664
GitDescription: v1.11.0
Platform: linux/amd64
GoVersion: go1.22.5
Compiler: gc

• OS (cat /etc/os-release):

NAME="AlmaLinux"
VERSION="9.4 (Seafoam Ocelot)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="AlmaLinux 9.4 (Seafoam Ocelot)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"
HOME_URL="https://almalinux.org/"
DOCUMENTATION_URL="https://wiki.almalinux.org/"
BUG_REPORT_URL="https://bugs.almalinux.org/"

ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"
ALMALINUX_MANTISBT_PROJECT_VERSION="9.4"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.4"
SUPPORT_END=2032-06-01

• Dependency-Track

Version: 4.11.6

[spiffcs]

Thanks for the easy reproduce and bug report @scom-technology-operations! I've picked this up and will get a fix added for our next release.

[escalate]

Hey everybody,
are here any news about the release?
Best regards
Felix